Cloud Managed Networks

 View Only

  • 1.  Wired Guest Port with Captive Portal in Central CNX

    Posted 5 days ago

    I'm trying to replicate a guest wired port on both an AP and a gateway port.   We use this to provide things like connections to guest switches, IoT devices, and guest printers.  I am familiar with how this is done in AOS 8 but I cannot get it to work in Central CNX.  

    For the AP my current AOS 8 solution is using tunneled mode.  In CNX I only see a bridge mode option. Is there a way to still use tunneled? 

    For the gateway I created a port profile and applied it to a port on the gateway.  IIt is telling me to apply an aaa profile to the vlan used in the port profile but when I try to apply the aaa profile I keep getting different errors.

    Anyone out there that can help with some steps?



  • 2.  RE: Wired Guest Port with Captive Portal in Central CNX

    Posted 4 days ago

    In CNX, both WLAN and Wired port profiles for AP's support the option for tunnel. Just keep in mind that the 802.11 frames are not forwarded to gateway in tunneled mode on aos 10. Its really the vlan is tunneled and the user-role is centralized. 

    When you get your gateway and AP's setup in CNX then a dedicated profile can be created to tunnel the wired users for those services. When you use captive portal on the AP itself, the AP will be the one hosting the splash page. 




  • 3.  RE: Wired Guest Port with Captive Portal in Central CNX

    Posted 4 days ago

    I recently put a technote together for New Central Configuration for Tunnelled WLANs with ClearPass being the auth server /captive portal. even tough it is not for the wired port of the APs. The principle is the same. see if that is useful.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 4.  RE: Wired Guest Port with Captive Portal in Central CNX

    Posted 3 days ago
    Edited by AS-e049ea 3 days ago

    Thank you I have the Wired AP solution working now but I still need to get a wired port on the controller to work.  So far I have the port profile setup and applied to the gateway interface but the primary different between this and the AP port profile is there is no option to add a Captive portal or a default role.  So instead I went to the VLAN and added gateway parameters with an aaa profile but it will not take/save the changes.

    My SE had me do the command show user ip - and it looks like the default aaa profile is being used.  My user is in the correct vlan and gets the correct IP just gets in the logon role instead of the guest logon role I want them to be in.

    Wired AP is working good.   

    Working on wired gateway port now.   A 70010 controller.  I created a port profile and an interface profile for a 7010.  Assigned port 0/0/10 with the port profile.  When I connect my laptop I get the logon role not the guest logon role.  The issues are IMO either:

    1. The port profile for a gateway is missing the CP and role settings like an AP port profile supports.  See images below.  Starting with how it is on an AP.

     

    image
    image

    But on a gateway Port profile we do not have the same fields.

    image

     

    So I tried to create an AAA-Guest-Logon profile and assign it to the VLAN but not sure how this helps because the AAA profile doesnt have anything for CP either.  And if I dont select Authentiction Protocol "mac" I do not get gateway parameters option.

     

    image

     

    Edited the VLAN

    image

    No go.  I get an IP and can ping default gateway but no CP.  On the gateway I am in the logon role which is wrong.  Any idea how I set the role I need?



  • 5.  RE: Wired Guest Port with Captive Portal in Central CNX

    Posted 3 days ago

    The process for the gateway has been this of below. I did take a quick look and not seeing anything obvious as to an initial role in the AAA profile. I am wondering if the current work flow assumes you will use mac-auth to return captive portal profile. I would generally agree you should be able to do local web auth without layering in mac-auth. 

    You can use the role-how and vlan-how commands while troubleshooting to see if something is updated or where its derived. I suspect the commands still work. 

    • show aaa state station xx:xx:xx:xx:xx:xx    (look for role-how, and vlan-how)
    • show aaa debug role user mac xx:xx:xx:xx:xx:xx
    • show aaa debug vlan user mac xx:xx:xx:xx:xx:xx

    Traditional Gateway process

    • physical interface and/or vlan is set to untrusted (this will trigger the aaa auth wired config)
    • aaa auth wired (this will default to your aaa profile)
    • aaa profile xxxxx (this will have your default role, and radius servers)
    • user-role xxxx (this will link your captive portal profile)

    Just by the work flow changes and what you are stating is happening on the gateway side. I suspect there is nothing in the config to tell the user to use the role you want to use. It also looks like you can use a user role to apply a captive portal profile for the gateway side. 

    I did take a look at the api and it seems in the authorization section there are a few "roles" that can be applied. My guess is the work flow does not have this yet in the web. I do believe they are working on new work flows. You probably would just have to layer in mac-auth to return a role or update the initial role via API. I would need to run show commands but it almost looks as the auth-role could be the initial role of the AAA profile. 

    https://developer.arubanetworks.com/new-central-config/reference/createaaaprofileprofilebyid


    Original Message


Related Content